Bump github.com/gotenberg/gotenberg/v8 from 8.31.0 to 8.34.0

[dependabot]

Bumps github.com/gotenberg/gotenberg/v8 from 8.31.0 to 8.34.0.

Release notes

Sourced from github.com/gotenberg/gotenberg/v8's releases.

8.34.0

Security Fixes ⚠️

• Block content linked from untrusted locations in LibreOffice. An uploaded document could reference external (http(s)://) or local (file:///…) resources that LibreOffice resolved during conversion, giving blind SSRF and a limited local-file read. The soffice profile now sets BlockUntrustedRefererLinks, so soffice refuses to load any content a document links. Embedded content is unaffected; documents relying on linked resources no longer render them.

New Features

• Factur-X / ZUGFeRD metadata (#1552). Conversions now inject the matching XMP metadata, and the API replaces the single facturx payload with dedicated form fields. Thanks @​fank.
• Owner-only encryption and permissions. A new ownerPassword, independent of userPassword, plus permission controls restrict what a viewer may do without locking the document open.
• log-std-level-case (#1339). New flag to set the level field casing in standard output, lower (default) or upper. Thanks @​Jaben.

Observability

• Trace enrichment. New process.exec client spans, supervisor queue-wait and launch sub-spans, a Chromium print_to_pdf sub-span, backing-binary versions (Chromium, LibreOffice, qpdf, …) recorded on spans and captured at build time, and per-conversion I/O, network, and size attributes on Chromium and LibreOffice spans.
• Error classification. Chromium and LibreOffice failures set an error.type from a bounded enum.
• Richer resource and metrics. Process, OS, host, and container resource detectors, semconv aligned to v1.41.0, a trace-based exemplar filter, and conversions-since-restart and queue-depth gauges.

Bug Fixes

• CSV conversions leaked the upload's UUID filename as a page header (#1568). Calc printed the sheet name, which was the UUID-based upload filename, as a centered page header. Now suppressed. Thanks @​vapranav.
• Webhook async lost trace context. The async delivery goroutine detached from the request context and dropped the trace, breaking span continuity. It now preserves the context via context.WithoutCancel.
• ca-certificates missing in the chromium-only image. Outbound TLS could fail in the chromium-only build. The package is now installed. Thanks @​osvein.
• LibreOffice core-dump retries. Retries on ErrCoreDumped are now capped and observable, and the ErrRuntimeException message is corrected.

Chore

• Updated Chromium to version 149.0.7827.102-1.
• Updated Go dependencies.

8.33.0

Security Fixes ⚠️

• Block IPv6 prefixes that tunnel to internal IPv4 in IsPublicIP. ::ffff:10.0.0.1, 2002:c0a8:: (6to4), and 2001::/32 (Teredo) embed an internal IPv4 destination inside an IPv6 address. IsPublicIP evaluated only the outer IPv6 form, so --*-deny-private-ips filters let the embedded private IPv4 reach the dialer. The check now unwraps IPv4-mapped, IPv4-translated, 6to4, and Teredo addresses, and rejects them when the embedded IPv4 is non-public.
• Strip backslash separators from supplied filenames. Linux treated a caller-supplied Gotenberg-Output-Filename header or filename form field containing ..\ or foo\bar as a single segment. The handler now strips both forward-slash and backslash path separators before composing the output path.

New Features

• Device scale ratio for screenshots (#1543). A new deviceScaleFactor form field on /forms/chromium/screenshot/{html,url,markdown} controls the screenshot pixel density. Defaults to 1. Thanks @​hovcharenko.

Bug Fixes

• Pinning proxy outlived a failed Chromium start. When chromedp failed to start (port conflict, container OOM, sandbox denial), the loopback HTTP/CONNECT pinning proxy added in 8.32.0 stayed bound to its port and leaked across restart attempts. The browser now stops the pinning proxy on every start failure.
• Lifecycle listener race on Navigate. chromedp.Navigate could fire Page.lifecycleEvent before Gotenberg's listener subscribed, so the converter occasionally waited the full network-idle timeout on otherwise fast pages. Listeners now register before navigation.
• Supervisor flapped on transient CDP latency. A single slow CDP health probe marked the supervised process unhealthy and triggered a restart, even when the next probe succeeded. Probes now require N consecutive failures before reporting unhealthy.
• downloadFrom concurrent map writes. Parallel downloadFrom entries merged results into a shared map without a lock. Under enough concurrency this raced and panicked the request goroutine. Result merging is now serialized.
• Pinning-proxy noise on client cancellations. context canceled and connection reset by peer from the client side of the pinning proxy logged at error level, flooding logs whenever a caller aborted mid-render. Client-cancelled dial errors now log at debug.

Chore

• Updated Chromium to version 148.0.7778.178-1.

... (truncated)

Commits

• 98fc403 feat(libreoffice): block linked content from untrusted locations
• 808a96f chore: rename factur x engine
• d4c20c6 feat(telemetry): record backing-binary versions on spans, captured at build time
• 2050b4a chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.4 to 4.26.5
• c0ed2de feat(qpdf): record Factur-X and PDF/A attributes on traces
• f8905ba refactor: make client- and operator-facing error messages clearer and actionable
• 3b1e4cb feat(pdfengines): support owner-only encryption and document permissions
• 287ee5b feat(pdfengines): redesign Factur-X API with dedicated form fields
• 9ab39b6 fix(libreoffice): suppress auto-generated page header for CSV conversions
• 5558e43 feat(pdfengines): inject Factur-X/ZUGFeRD XMP metadata
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)